I've given my share of AI talks where the frontier labs had already paralyzed many people with fear. The machines are taking our jobs, they will kill everyone, etc. Our standing-room-only event at @BSidesCbr was a vibes shift, and I'm guessing others are feeling it too: 120 folks ranging from security program leaders to curious engineers to working analysts went hands-on. By the end, they were kicking off agentic investigations that automatically and reliably timelined incidents in minutes that used to take senior folks hours. Goodbye FUD, and hello awareness, curiosity, determination, and a lot of smiling. That was also a surprise scale test for us. We were standing room only with double the participants of our popular Black Hat training with @Cyb3rWard0g last year. Thankfully, Sindre and the @louie_ai investigation harness took it in stride: the only real issue was event space wifi. Even when people get past the fear, this stuff is hard. We started our agentic investigation training because hundreds of thousands of analysts need to learn it, and our experience onboarding users to agentic coding is that it takes weeks and months rather than hours and days. I do claim a little credit for our team here: the training keeps getting smoother, and the harness keeps getting better at making agentic investigations easier, more transparent, more automated, and more accessible. Onboarding hundreds of thousands of analysts into agentic investigation best practices used to feel intimidating. That is a lot of people, and with the frontier labs marketing FUD, it meant reaching not just their minds but spirits. It feels very doable now! Next up: - trainings at @BSidesAugusta + online - lessons learned on AI-powered investigations at @unpromptedconf (#sf) , @BSidesNYC , @LASCONATX (#austin) Links below + DM me to meet while we're in town!

Our first weights drop: GLM 5.3 Flash W4AFP8 quant by @Graphistry / @LOUIE_AI means you can now run on half as many H-series GPUs Run on smaller rigs, and for bigger ones, double your token count! Already getting downloaded before we had time to announce 🤯 botsbench numbers coming up shortly Ex: 4-8 x H200 => 2 x H200 Ex: 8 x H100 => 4 x H100 How: New models generally target new GPU generations that use new kinds of floating point data representations that don't work on older GPUs. We work w/ teams using H200's etc which means rejiggering weights to more traditional fp8/int4 reps, and there is a bit of nuance to what you want to use where GLM 5.3 Flash benchmarks great on botsbench, so enjoy the quant!

I'll be presenting at @SANSInstitute tomorrow on a topic I expect we will be talking about a lot over the next year: Making it a boring predictable process to go from regular investigations to agentic investigations. At the organization level, this answers how to build an AI Factory Factory (not a typo). The short answer is rethinking around evals and people. One part of this I shared at blackhat week (#unprompted day 1 of @BSidesLV, second talk of the day - video on YouTube): our study on adversarial evals and how it is important not to trick ourselves on high scores with the many ways AI models & agents are cheating at exams. This focuses on the 'less bad' side of the process, and importantly, provides the security engineering discipline of threat modeling for systematically approaching it. The SANS talk focuses more on the core work of ensuring the behavior we want is happening. Just like good tests tell us a system is working well and pinpoints broken areas to focus on, evals tell us the same thing when working with fuzzier systems like skill.md files, tools for improving agent behavior, agent definitions, harnesses that learn, model fine tunes, context layers & memory, picking models, etc. I share a lot of specific learnings here, like why Luna is a fascinating model, but the meta is the engineering approach to put all this on rails. Evals say little about people. We built Louie Desktop to enable individual investigators to turn the volume knob to 11 without the complexity of organizational change. However, data is a "better together" scenario, and so as much as we build to enable blocks here, we are also working with our users and build in features aimed at the more harmonious networked and cooperative state. Learning, sharing, etc matters for both people and agents. Likewise, just as interesting as cars are for achieving high speeds, are the highway systems for making them safe. In a sense, this is the harder problem, especially when we need to help the 100k-400k people directly working on this stuff. anyways, see folks at SANS this week, and DM to say hello! @SANSInstitute @fykim @robtlee

2c from a top scorer: - we had a top % (won't say which), and likely top 1-3 if no logistic issues like not having the wrong hour for final submissions - we stick to max subs, so cap $100-400/mo/person - we learned a lot, both our 1 cyber & 2 non-cyber teammates - the skillset has changed: we've been llm-pilled for 3+ years, so not about our token burn, but how we use them, and this taught us more about what to do and what we roll into our tools (louie, gfql, ...) & methods

Which graph query language would you most like to see #GFQL support next? For those new to it, GFQL is our open-source, embeddable graph query language built for compute-tier (not storage-tier) workloads. Think daily tasks like on-the-fly graph ETL, analytics, ML, AI, and visualization. It runs directly on columnar data (Pandas/Apache Arrow) with optional GPU acceleration (NVIDIA RAPIDS) - @kuzudb shared many of the same principles. We're nearing expressive parity in the core engine with #OpenCypher (@Neo4j) for typed property graphs, and by design, already do plenty of things it cannot. Community feedback is welcome! As we expand beyond the current @PyData / @nvidia @RAPIDSai / JSON bindings, we’re exploring which external syntaxes and interop models people most want & need. Can use help answering this one 💪🏁

We're launching something new to help investigation & automation teams🤠 When the @LOUIE_AI team went from announcing the first agentic AI speed-run of Splunk's annual Boss of the SOC investigation CTF at #RSAC → then helping 100+ hackers build their first AI agents at #BlackHatUSA with @Cyb3rWard0g , it was clear: How to do agentic AI well needs to reach more of the investigation & automation community. So, I'm happy to share we're starting a 2-day online masterclass "From AI Copilot to Commander" (16 CPE credits) Think big picture views on what works today and what's next, and going hands-on with an AI cyber range for RAG, evals, investigation agents, OSS tools, MCP, semantic layer, etc on your choice of @splunk , @databricks , #kusto @AzDataExplorer . Link in comments, and stay tuned for a @LOUIE_AI announcement on the software side of this same community direction. Fall is heating up! 🔥 cc @vicfcs @dawnsongtweets @cosh23 @Cyb3rWard0g @JohnLaTwC @ram_ssk

As we apply LLMs and AI agents to automating as much of our work as we can in coding, investigations, and ops, I’ve been noticing an interesting pattern of ~4 stages for how that work progresses: - AI Pairing - AI Delegation - AI Multtasking - AI Automation & Autonomy =>

Biggest internal takeaway from @louie_ai dropping the best AI benchmark result of all #RSAC blue team AI x Security tools: We have a dream job opening for a security AI whisperer! 3 steps: - see the @graphistry video of our @splunk BOTS speedrun 🤯 - apply for our AI Security opening if a dream job for you.. - or share w/ colleagues if for them We don't get to make roles like this often, so super excited!

The biggest news from my Graph the Planet keynote is that @louie_ai is the first #GenAI investigation agent to successfully speed-run @Splunk's annual Boss of the SOC (BOTS) competition: Thousands of professional cybersecurity analysts tackle BOTS every year, and Louie not only took the challenge, but completed a speed run well beyond most humans. Louie successfully tackled: - 100% of the 2xx-series questions - 50% of the 3xx-series - Turned what takes teams of analysts hours into mere minutes - Cut analyst workloads by 90%+ Why is this a big deal? Like OpenAI's breakthrough in passing medical and legal exams, Louie’s results mark that same watershed moment for AI in investigations. BOTS challenges pushes analysts to apply deep knowledge, creative intuition, and proficiently navigate databases and Python scripts to tame massive logs of machine and human activities. Our first numbers are forcing senior-most discussions with our major AI and CISO partners. These results are just from "Louie 1.x" - we're already deep into "Louie 2.x" developments, and are excited to share more. Check out the video for a feel! Presciently, @Berkeley_EECS Professor @dawnsongtweets made the call-to-arms during her @graphtheplanet talk that, critical for trust and progress in security AI investigations, is benchmarks that are transparent, rigorous, and open. We must break the pattern of tool providers writing their own tests, grading their own homework, and comparing to misleading baselines. Louie's BOTS speed run is a first step, measuring not only skill, speed, time savings, and accuracy, but also non-obvious requirements like budget caps. We are excited for new challenges in the coming months. On a personal note, an urgent priority for our team is easing the massive stress on security teams and their families, especially on defenders struggling with budget cuts . One government leader shared they routinely follow up their regular day with additional hours in the evening reviewing the day's incidents, and dreads when those turn into overnight crises. Easing these processes is more of an essential duty than a product feature. Ultimately, our work with genAI investigations isn't about replacing analysts, but transforming how people and machines work together. From cybersecurity to fraud to healthcare to financial trading, operational systems are freeing analysts from low-level work to managing agents that continuously learn under data flywheels. Excitingly, just as "Vibes Coding" developer tools like @cursor_ai and GitHub Copilot are revolutionizing software engineering at an unprecedented rate of adoption, we have spent the last 2 years building "#VibesInvestigating" for analysts to manage their side of the AI revolution using more humane and integrated tools like AI notebooks. There is more to share: Stay tuned for the graph side of my keynote, takeways from our great speakers this year, and meanwhile, reach out if you want to exchange notes on genAI & graphs in security!

See everyone in 1 hour! And yes, you can join the free virtual track for all the genAI + graph fun, we will be doing QA etc there (Slack + YouTube):

I'm increasingly doing something we're calling "Vibes Investigating" in the @louie_ai team (ht @silkspaceships ) This rethinks @karpathy’s "Vibes Coding", now for data - think operations, incident response, fraud, SRE, logs, data science I make requests, see results, adjust, and repeat: No manually writing database queries, hand-coding data transforms, or fiddling with plotting libraries At the end, I trash it as I would a Splunk/Google search result, or I share my AI notebook just as I would a regular Google document or Python notebook Some recent examples: - Pairing session for a high-stakes lawsuit where we edited visualizations and analyses on-the-fly. This skipped a week of back-and-forth follow-up Slack messages & calls. - Quickly identifying and running some statistical analyses for the same case. Ex: median absolute deviation instead of the standard. - Exploring a logs dump to map a cyber pen test team’s activity, and then remixing the best parts into an account 360 dashboard. Think big join queries that are frustrating to code but easy to describe. I’ve been surprisingly OK with the AI messing up As we build @louie_ai and I use it for my own work, I'm thinking a lot more about Vibes Investigating. What's working, differences with software-centric vibes flows vs data-centric, and dovetailing with automation as we bring AI to operations. Curious what others are seeing and thinking about here! (+, DM if at #RSAC / graph the planet next week!) tx for discussions & inspiration over last year+ - @vicfcs @dawnsongtweets @matei_zaharia @anthonygtellez @Cyb3rWard0g @simonw

Google’s biggest-ever $32B #Wiz cyber acquisition is so big that genAI news is ho-hum despite it being #Nvidia #GTC week... Or so it seems: As a CEO building deep tech right in the middle of all these things for years now, first with @Graphistry and now also @LOUIE_AI , the real story to me isn’t the future of cloud security. It’s cloud security **AI**. My three 🤔 behind this: 1️⃣ Graph is the security intelligence layer Wiz's internals look similar to what top security teams do, whether it's one of the top 3 cloud providers or a three letter agency: they understand risk isn’t about asset lists, it’s about the relationships between them. Core Wiz tech tracks cloud physical and logical assets as a graph. Underneath it all? One of our favorite partners, @awscloud #AmazonNeptune. Beyond Wiz's cloud asset tracking, we work with customers every day as they extend this concept to their other assets like on-prem devices, and at the next magnitude of intensity of understanding dynamic event activities. 2️⃣ Google is doubling down on security data tech Chronicle (Google’s cloud SIEM) and Google Cloud don’t just want to secure infrastructure; they want to own the entire security data layer. Compliance, attack surface management—those are just applications of a much bigger shift. Wiz buys Chronicle a semantic asset layer into other clouds, as well as their customers. 3️⃣ AI for security is the end game The next wave isn’t just asset mapping and continuous compliance —it’s making sense of it all: Quickly, correctly, and automatically. The more the @Louie_ai team works with our customers on AI investigation copilots & autonomous investigation agents, the clearer I'm seeing it. Cleaning up the security intelligence layer is the difference between an AI stumbling through a swamp vs speeding down a highway. Graph is great for analysts today, and it is paving the way for AIs in the future. I've come to appreciate the best M&A deals are literally free. The stock jump covers the cost so you even make money. That’s not happening here, so the payback period will take time. For everyone in our community, however, this is a massive vote of confidence in graph, AI, and what is happening in investigation & security tech. @pacoid @pgosavi7056 @bigdata @jamescham @vicfcs @anton_chuvakin

Say hello to the @Graphistry 2025 GPU AI Remote Fellowship program! We're looking for 2 students (PhD/MS/BS) to hack on 1. Autonomous AI analysts 2. Multi-gpu OSS graph query languages These projects in turn power how we work with banks, NGOs, the US gov, and others for data-intensive investigations in cybersecurity, disaster response, anti-misinformation, clickstream analytics, and other areas On a personal note, one of the reasons we started Graphistry was to build an organization who could grow to support this kind of meaningful research, so we're quite excited about the coming months! Please share with ambitious students you know and may be looking for the right opportunity :)

Big congrats to the @RAPIDSai #cuGraph team for debuting at #3 on the Graph500 at @supercomputing #sc24 ! Can't wait for the next submission on a bigger rig! We at first thought we had our numbers wrong last year when we internally measured our new open source GFQL graph query language, which uses cuGraph as one of its GPU components, and saw it at the ~#100 rank on cheapo $0.25/hr GPUs. Seeing this first official ranking is amazing and long overdue. It takes a village!

Starting in a few! Extra fun b/c we went hard on the genAI side: - How to think about RAG for security in general - A look at genAI for rule management in bigger shops - What starts mattering when you hit 1M+ embeddings - Investigations take graph thinking, so doing that in RAG pipelines